Big Brother Meets Joe Friday. Sutter Health Facts

Transcription

1 Big Brother Meets Joe Friday Presented by: Christine Jensen, Privacy Investigation Manager Brian Callihan, Director of Special Projects Tuesday April 19, :30 p.m. Sutter Health Facts Physicians (Members of Sutter Medical Network) 5,000 Hospitals 24 Network and Affiliate Employees 49,381 Outpatient Surgery Centers 33 Cardiac Centers 6 Cancer Centers 9 Acute Rehabilitation Centers 5 Behavioral Health Centers 6 Trauma Centers 5 Licensed Acute Care Beds 4,321 Neonatal Intensive Care Units 9 Volunteers 5,000 1

2 Privacy Auditing and Monitoring Data Obtain Electronic Health Record Access Data Who? When? How Long? What? Obtain Supporting Data Patient Demographic Data Workforce Demographic Data Workforce Facility Data Workforce Reporting Relationships Proactive Privacy Auditing and Monitoring Rules Relationship-Based Reviews Co-Workers Accessing Co-Workers Same Street Same Household Same Last Name Non-Relationship Based Reviews Deceased Patients Excessive Session Duration Discharged Patients New Hire 2

3 Identify Incident for Investigation Possible Scenarios for Appropriate Access or False Positives User Is Involved in Scheduling User Is HIM Employee User Is Member of Care Team Signed Authorization Patient Receiving Care in User s Department Identify Incident for Investigation (cont.) Possible Scenarios for Inappropriate Access Patient Not Seen in User s Department Patient Did Not Receive Services Recently Patient Has Encounters for Serious Condition User Specifically Accessed Patient Record User s Specialty Not Relevant to Patient Lengthy Time Spent in EHR 3

4 Create Incident for Investigation Dates Date Incident Occurred Date Incident Discovered Date Reported to Privacy Officer Identify Relationships Co-Workers Neighbors Family Members User Details Create Incident for Investigation (cont.) Job Title Job Duties Reporting Relationships Union Employee Patient Details Age Sex Patient Condition /Treatment Documentation Access Logs Verbal or Expired Authorizations Incident Report 4

5 Template Incident Report Create Standard Language 9 Additional Review Requests Specific Record Reviews High-Profile Patients Suspicious User Additional Incident Review Expand the Review Period Expand Co-Worker Review Expand Family Review Compare Access Activity to Similar User 5

6 Review Results for Quality Analysis Positive Findings Review Validating Data Analysis Identify Patterns Negative Findings Review Identify Review Process Gap Analyst Missed User Provided Care Patient Requested User to Access Record Adjust Review Process Where Appropriate 11 Now to the Investigation What Steps Do You Need To Take? 12 6

7 Just the Facts Do not have a conclusion before you start Put aside views on certain employees before you start Be alert for other issues or concerns as you investigate Always focus on collecting only factual information 13 Educate Yourself Remain objective at all times Learn the layout of the location of the alleged breach Identify the organizational structure where the alleged breach occurred Learn the roles and responsibilities of the employees where the alleged breach occurred 14 7

8 Additional Considerations Determine and evaluate employee/interviewee training and certifications Partner with other relevant stakeholders in the investigation Law enforcement / regulatory agencies may enter the picture 15 Develop a Plan Consider a uniform workflow for conducting the investigation Planning is the most important phase of the investigation Develop chronology for how you will proceed Follow the plan in all investigations Who, what, where, when & why are the foundation 16 8

9 Conduct Interviews Consider using a standard line of questions Standard admonishments Select the appropriate team to conduct interviews Strategize the interview room setup Allow adequate time for the interview Be well prepared for the interview 17 Evaluate the Interviews Assessment of credibility may be very important Inconsistent version of events or evasion may be critical Does the version of events make sense? Consider re-interviewing or expanding the number of interviewees 18 9

10 Document Investigation Factually summarize the interviews Preserve the audit logs or other data Collect and preserve any relevant additional evidence that may exist Documentation is important for potential civil litigation and regulatory inquiries May include a summary report 19 Focus on Corrective Action Part of investigation is to identify process issues to prevent a recurrence We should learn from every incident Employee action or remediation coordinate with Human Resources to make sure consistent action is taken 20 10

11 Questions 21 Contacts Christine Jensen Brian Callihan